daycare-cli 0.0.26 → 0.0.28

package/dist/engine/apps/appToolExecutorBuild.spec.js

@@ -0,0 +1,227 @@
+import { Type } from "@sinclair/typebox";
+import { describe, expect, it, vi } from "vitest";
+import { appToolExecutorBuild } from "./appToolExecutorBuild.js";
+describe("appToolExecutorBuild", () => {
+    it("passes through allowed calls after ALLOW review", async () => {
+        const execute = vi.fn(async () => toolResultBuild(false, "read ok"));
+        const resolver = resolverBuild(execute);
+        const executor = appToolExecutorBuild({
+            appId: "github-reviewer",
+            appName: "GitHub Reviewer",
+            appSystemPrompt: "You are a focused review assistant.",
+            reviewerEnabled: true,
+            rlmEnabled: false,
+            sourceIntent: "Review pull requests safely.",
+            rules: { allow: [], deny: [] },
+            inferenceRouter: inferenceRouterBuild("ALLOW"),
+            toolResolver: resolver
+        });
+        const result = await executor.execute({ id: "t1", name: "read", type: "toolCall", arguments: { path: "/tmp/a.txt" } }, contextBuild());
+        expect(execute).toHaveBeenCalledTimes(1);
+        expect(result.toolMessage.isError).toBe(false);
+    });
+    it("returns tool error when review denies", async () => {
+        const execute = vi.fn(async () => toolResultBuild(false, "should not run"));
+        const resolver = resolverBuild(execute);
+        const executor = appToolExecutorBuild({
+            appId: "github-reviewer",
+            appName: "GitHub Reviewer",
+            appSystemPrompt: "You are a focused review assistant.",
+            reviewerEnabled: true,
+            rlmEnabled: false,
+            sourceIntent: "Review pull requests safely.",
+            rules: { allow: [], deny: [] },
+            inferenceRouter: inferenceRouterBuild("DENY: blocked by rules"),
+            toolResolver: resolver
+        });
+        const result = await executor.execute({ id: "t1", name: "exec", type: "toolCall", arguments: { command: "rm -rf ." } }, contextBuild());
+        expect(execute).not.toHaveBeenCalled();
+        expect(result.toolMessage.isError).toBe(true);
+        expect(contentText(result.toolMessage)).toContain("blocked by rules");
+    });
+    it("returns tool error for tools outside the app allowlist", async () => {
+        const execute = vi.fn(async () => toolResultBuild(false, "should not run"));
+        const resolver = resolverBuild(execute);
+        const executor = appToolExecutorBuild({
+            appId: "github-reviewer",
+            appName: "GitHub Reviewer",
+            appSystemPrompt: "You are a focused review assistant.",
+            reviewerEnabled: true,
+            rlmEnabled: false,
+            sourceIntent: "Review pull requests safely.",
+            rules: { allow: [], deny: [] },
+            inferenceRouter: inferenceRouterBuild("ALLOW"),
+            toolResolver: resolver
+        });
+        const result = await executor.execute({ id: "t1", name: "cron", type: "toolCall", arguments: { action: "list" } }, contextBuild());
+        expect(execute).not.toHaveBeenCalled();
+        expect(result.toolMessage.isError).toBe(true);
+        expect(contentText(result.toolMessage)).toContain("not available in app sandbox");
+    });
+    it("includes run_python in app allowlist when resolver exposes it", () => {
+        const execute = vi.fn(async () => toolResultBuild(false, "ok"));
+        const resolver = resolverBuild(execute);
+        const executor = appToolExecutorBuild({
+            appId: "github-reviewer",
+            appName: "GitHub Reviewer",
+            appSystemPrompt: "You are a focused review assistant.",
+            reviewerEnabled: true,
+            rlmEnabled: false,
+            sourceIntent: "Review pull requests safely.",
+            rules: { allow: [], deny: [] },
+            inferenceRouter: inferenceRouterBuild("ALLOW"),
+            toolResolver: resolver
+        });
+        expect(executor.listTools().map((tool) => tool.name)).toContain("run_python");
+    });
+    it("includes request_permission in app allowlist when resolver exposes it", () => {
+        const execute = vi.fn(async () => toolResultBuild(false, "ok"));
+        const resolver = resolverBuild(execute);
+        const executor = appToolExecutorBuild({
+            appId: "github-reviewer",
+            appName: "GitHub Reviewer",
+            appSystemPrompt: "You are a focused review assistant.",
+            reviewerEnabled: true,
+            rlmEnabled: false,
+            sourceIntent: "Review pull requests safely.",
+            rules: { allow: [], deny: [] },
+            inferenceRouter: inferenceRouterBuild("ALLOW"),
+            toolResolver: resolver
+        });
+        expect(executor.listTools().map((tool) => tool.name)).toContain("request_permission");
+    });
+    it("bypasses review model when reviewer is disabled by config", async () => {
+        const execute = vi.fn(async () => toolResultBuild(false, "read ok"));
+        const resolver = resolverBuild(execute);
+        const complete = vi.fn(async () => ({
+            providerId: "provider",
+            modelId: "model",
+            message: {
+                role: "assistant",
+                content: [{ type: "text", text: "DENY: should not be used" }],
+                api: "openai-responses",
+                provider: "provider",
+                model: "model",
+                usage: {
+                    input: 0,
+                    output: 0,
+                    cacheRead: 0,
+                    cacheWrite: 0,
+                    totalTokens: 0,
+                    cost: {
+                        input: 0,
+                        output: 0,
+                        cacheRead: 0,
+                        cacheWrite: 0,
+                        total: 0
+                    }
+                },
+                stopReason: "stop",
+                timestamp: Date.now()
+            }
+        }));
+        const inferenceRouter = { complete };
+        const executor = appToolExecutorBuild({
+            appId: "github-reviewer",
+            appName: "GitHub Reviewer",
+            appSystemPrompt: "You are a focused review assistant.",
+            reviewerEnabled: false,
+            rlmEnabled: false,
+            sourceIntent: "Review pull requests safely.",
+            rules: { allow: [], deny: [] },
+            inferenceRouter,
+            toolResolver: resolver
+        });
+        const result = await executor.execute({ id: "t1", name: "read", type: "toolCall", arguments: { path: "/tmp/a.txt" } }, contextBuild());
+        expect(complete).not.toHaveBeenCalled();
+        expect(execute).toHaveBeenCalledTimes(1);
+        expect(result.toolMessage.isError).toBe(false);
+    });
+});
+function inferenceRouterBuild(text) {
+    return {
+        complete: vi.fn(async () => ({
+            providerId: "provider",
+            modelId: "model",
+            message: {
+                role: "assistant",
+                content: [{ type: "text", text }],
+                api: "openai-responses",
+                provider: "provider",
+                model: "model",
+                usage: {
+                    input: 0,
+                    output: 0,
+                    cacheRead: 0,
+                    cacheWrite: 0,
+                    totalTokens: 0,
+                    cost: {
+                        input: 0,
+                        output: 0,
+                        cacheRead: 0,
+                        cacheWrite: 0,
+                        total: 0
+                    }
+                },
+                stopReason: "stop",
+                timestamp: Date.now()
+            }
+        }))
+    };
+}
+function resolverBuild(execute) {
+    const schema = Type.Object({}, { additionalProperties: true });
+    return {
+        listTools: () => [
+            { name: "read", description: "read", parameters: schema },
+            { name: "write", description: "write", parameters: schema },
+            { name: "edit", description: "edit", parameters: schema },
+            { name: "exec", description: "exec", parameters: schema },
+            { name: "run_python", description: "run_python", parameters: schema },
+            { name: "request_permission", description: "request_permission", parameters: schema },
+            { name: "cron", description: "cron", parameters: schema }
+        ],
+        execute: vi.fn(async () => execute())
+    };
+}
+function toolResultBuild(isError, text) {
+    return {
+        toolMessage: {
+            role: "toolResult",
+            toolCallId: "t1",
+            toolName: "read",
+            content: [{ type: "text", text }],
+            isError,
+            timestamp: Date.now()
+        },
+        files: []
+    };
+}
+function contextBuild() {
+    return {
+        connectorRegistry: null,
+        fileStore: null,
+        auth: null,
+        logger: console,
+        assistant: null,
+        permissions: {
+            workingDir: "/workspace",
+            writeDirs: ["/workspace"],
+            readDirs: ["/workspace"],
+            network: false,
+            events: false
+        },
+        agent: { id: "agent-1" },
+        source: "test",
+        messageContext: {},
+        agentSystem: null,
+        heartbeats: null
+    };
+}
+function contentText(message) {
+    return message.content
+        .filter((entry) => entry.type === "text")
+        .map((entry) => entry.text)
+        .join("\n");
+}
+//# sourceMappingURL=appToolExecutorBuild.spec.js.map

package/dist/engine/apps/appToolExecutorBuild.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appToolExecutorBuild.spec.js","sourceRoot":"","sources":["../../../sources/engine/apps/appToolExecutorBuild.spec.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAIlD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,oBAAoB,CAAC;YACpC,KAAK,EAAE,iBAAiB;YACxB,OAAO,EAAE,iBAAiB;YAC1B,eAAe,EAAE,qCAAqC;YACtD,eAAe,EAAE,IAAI;YACrB,UAAU,EAAE,KAAK;YACjB,YAAY,EAAE,8BAA8B;YAC5C,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;YAC9B,eAAe,EAAE,oBAAoB,CAAC,OAAO,CAAC;YAC9C,YAAY,EAAE,QAAQ;SACvB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CACnC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAC/E,YAAY,EAAE,CACf,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC,CAAC;QAC5E,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,oBAAoB,CAAC;YACpC,KAAK,EAAE,iBAAiB;YACxB,OAAO,EAAE,iBAAiB;YAC1B,eAAe,EAAE,qCAAqC;YACtD,eAAe,EAAE,IAAI;YACrB,UAAU,EAAE,KAAK;YACjB,YAAY,EAAE,8BAA8B;YAC5C,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;YAC9B,eAAe,EAAE,oBAAoB,CAAC,wBAAwB,CAAC;YAC/D,YAAY,EAAE,QAAQ;SACvB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CACnC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAChF,YAAY,EAAE,CACf,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC,CAAC;QAC5E,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,oBAAoB,CAAC;YACpC,KAAK,EAAE,iBAAiB;YACxB,OAAO,EAAE,iBAAiB;YAC1B,eAAe,EAAE,qCAAqC;YACtD,eAAe,EAAE,IAAI;YACrB,UAAU,EAAE,KAAK;YACjB,YAAY,EAAE,8BAA8B;YAC5C,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;YAC9B,eAAe,EAAE,oBAAoB,CAAC,OAAO,CAAC;YAC9C,YAAY,EAAE,QAAQ;SACvB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CACnC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAC3E,YAAY,EAAE,CACf,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,oBAAoB,CAAC;YACpC,KAAK,EAAE,iBAAiB;YACxB,OAAO,EAAE,iBAAiB;YAC1B,eAAe,EAAE,qCAAqC;YACtD,eAAe,EAAE,IAAI;YACrB,UAAU,EAAE,KAAK;YACjB,YAAY,EAAE,8BAA8B;YAC5C,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;YAC9B,eAAe,EAAE,oBAAoB,CAAC,OAAO,CAAC;YAC9C,YAAY,EAAE,QAAQ;SACvB,CAAC,CAAC;QAEH,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,oBAAoB,CAAC;YACpC,KAAK,EAAE,iBAAiB;YACxB,OAAO,EAAE,iBAAiB;YAC1B,eAAe,EAAE,qCAAqC;YACtD,eAAe,EAAE,IAAI;YACrB,UAAU,EAAE,KAAK;YACjB,YAAY,EAAE,8BAA8B;YAC5C,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;YAC9B,eAAe,EAAE,oBAAoB,CAAC,OAAO,CAAC;YAC9C,YAAY,EAAE,QAAQ;SACvB,CAAC,CAAC;QAEH,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YAClC,UAAU,EAAE,UAAU;YACtB,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE;gBACP,IAAI,EAAE,WAAoB;gBAC1B,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC;gBACtE,GAAG,EAAE,kBAA2B;gBAChC,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,OAAO;gBACd,KAAK,EAAE;oBACL,KAAK,EAAE,CAAC;oBACR,MAAM,EAAE,CAAC;oBACT,SAAS,EAAE,CAAC;oBACZ,UAAU,EAAE,CAAC;oBACb,WAAW,EAAE,CAAC;oBACd,IAAI,EAAE;wBACJ,KAAK,EAAE,CAAC;wBACR,MAAM,EAAE,CAAC;wBACT,SAAS,EAAE,CAAC;wBACZ,UAAU,EAAE,CAAC;wBACb,KAAK,EAAE,CAAC;qBACT;iBACF;gBACD,UAAU,EAAE,MAAe;gBAC3B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB;SACF,CAAC,CAAC,CAAC;QACJ,MAAM,eAAe,GAAG,EAAE,QAAQ,EAAgC,CAAC;QACnE,MAAM,QAAQ,GAAG,oBAAoB,CAAC;YACpC,KAAK,EAAE,iBAAiB;YACxB,OAAO,EAAE,iBAAiB;YAC1B,eAAe,EAAE,qCAAqC;YACtD,eAAe,EAAE,KAAK;YACtB,UAAU,EAAE,KAAK;YACjB,YAAY,EAAE,8BAA8B;YAC5C,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;YAC9B,eAAe;YACf,YAAY,EAAE,QAAQ;SACvB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CACnC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAC/E,YAAY,EAAE,CACf,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACxC,MAAM,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,SAAS,oBAAoB,CAAC,IAAY;IACxC,OAAO;QACL,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YAC3B,UAAU,EAAE,UAAU;YACtB,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE;gBACP,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;gBACjC,GAAG,EAAE,kBAAkB;gBACvB,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,OAAO;gBACd,KAAK,EAAE;oBACL,KAAK,EAAE,CAAC;oBACR,MAAM,EAAE,CAAC;oBACT,SAAS,EAAE,CAAC;oBACZ,UAAU,EAAE,CAAC;oBACb,WAAW,EAAE,CAAC;oBACd,IAAI,EAAE;wBACJ,KAAK,EAAE,CAAC;wBACR,MAAM,EAAE,CAAC;wBACT,SAAS,EAAE,CAAC;wBACZ,UAAU,EAAE,CAAC;wBACb,KAAK,EAAE,CAAC;qBACT;iBACF;gBACD,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB;SACF,CAAC,CAAC;KAC0B,CAAC;AAClC,CAAC;AAED,SAAS,aAAa,CAAC,OAA2C;IAChE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/D,OAAO;QACL,SAAS,EAAE,GAAW,EAAE,CAAC;YACvB,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE;YACzD,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE;YAC3D,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE;YACzD,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE;YACzD,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE;YACrE,EAAE,IAAI,EAAE,oBAAoB,EAAE,WAAW,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,EAAE;YACrF,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE;SAC1D;QACD,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,OAAgB,EAAE,IAAY;IACrD,OAAO;QACL,WAAW,EAAE;YACX,IAAI,EAAE,YAAY;YAClB,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACjC,OAAO;YACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB;QACD,KAAK,EAAE,EAAE;KACV,CAAC;AACJ,CAAC;AAED,SAAS,YAAY;IACnB,OAAO;QACL,iBAAiB,EAAE,IAA4D;QAC/E,SAAS,EAAE,IAAoD;QAC/D,IAAI,EAAE,IAA+C;QACrD,MAAM,EAAE,OAAoD;QAC5D,SAAS,EAAE,IAAI;QACf,WAAW,EAAE;YACX,UAAU,EAAE,YAAY;YACxB,SAAS,EAAE,CAAC,YAAY,CAAC;YACzB,QAAQ,EAAE,CAAC,YAAY,CAAC;YACxB,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SACd;QACD,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAA8C;QACpE,MAAM,EAAE,MAAM;QACd,cAAc,EAAE,EAAE;QAClB,WAAW,EAAE,IAAsD;QACnE,UAAU,EAAE,IAAqD;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,OAA0B;IAC7C,OAAO,OAAO,CAAC,OAAO;SACnB,MAAM,CAAC,CAAC,KAAK,EAA2C,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC;SACjF,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;SAC1B,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC"}

package/dist/engine/apps/appToolNameFormat.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Formats an app id into its public tool name.
+ * Expects: appId is a validated app manifest name.
+ */
+export declare function appToolNameFormat(appId: string): string;
+//# sourceMappingURL=appToolNameFormat.d.ts.map

package/dist/engine/apps/appToolNameFormat.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appToolNameFormat.d.ts","sourceRoot":"","sources":["../../../sources/engine/apps/appToolNameFormat.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEvD"}

package/dist/engine/apps/appToolNameFormat.js

@@ -0,0 +1,8 @@
+/**
+ * Formats an app id into its public tool name.
+ * Expects: appId is a validated app manifest name.
+ */
+export function appToolNameFormat(appId) {
+    return `app_${appId.replace(/-/g, "_")}`;
+}
+//# sourceMappingURL=appToolNameFormat.js.map

package/dist/engine/apps/appToolNameFormat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appToolNameFormat.js","sourceRoot":"","sources":["../../../sources/engine/apps/appToolNameFormat.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;AAC3C,CAAC"}

package/dist/engine/apps/appToolReview.d.ts

@@ -0,0 +1,27 @@
+import type { ToolCall } from "@mariozechner/pi-ai";
+import type { ProviderSettings } from "../../settings.js";
+import type { InferenceRouter } from "../modules/inference/router.js";
+import type { AppReviewDecision, AppRuleSet } from "./appTypes.js";
+type AppToolReviewInput = {
+    appId: string;
+    appName: string;
+    appSystemPrompt: string;
+    rlmEnabled: boolean;
+    sourceIntent: string;
+    toolCall: ToolCall;
+    rules: AppRuleSet;
+    availableTools: Array<{
+        name: string;
+        description: string;
+        parameters: unknown;
+    }>;
+    inferenceRouter: InferenceRouter;
+    providersOverride?: ProviderSettings[];
+};
+/**
+ * Calls the review model and decides whether an app tool call is allowed.
+ * Expects: rules and toolCall were prepared by the app executor.
+ */
+export declare function appToolReview(input: AppToolReviewInput): Promise<AppReviewDecision>;
+export {};
+//# sourceMappingURL=appToolReview.d.ts.map

package/dist/engine/apps/appToolReview.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appToolReview.d.ts","sourceRoot":"","sources":["../../../sources/engine/apps/appToolReview.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAGtE,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEnE,KAAK,kBAAkB,GAAG;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,OAAO,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,UAAU,CAAC;IAClB,cAAc,EAAE,KAAK,CAAC;QACpB,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,OAAO,CAAC;KACrB,CAAC,CAAC;IACH,eAAe,EAAE,eAAe,CAAC;IACjC,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,CAAC;CACxC,CAAC;AAEF;;;GAGG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA+BzF"}

package/dist/engine/apps/appToolReview.js

@@ -0,0 +1,53 @@
+import { messageExtractText } from "../messages/messageExtractText.js";
+import { appReviewPromptBuild } from "./appReviewPromptBuild.js";
+/**
+ * Calls the review model and decides whether an app tool call is allowed.
+ * Expects: rules and toolCall were prepared by the app executor.
+ */
+export async function appToolReview(input) {
+    const reviewPrompt = await appReviewPromptBuild({
+        appName: input.appName,
+        appSystemPrompt: input.appSystemPrompt,
+        rlmEnabled: input.rlmEnabled,
+        sourceIntent: input.sourceIntent,
+        toolName: input.toolCall.name,
+        args: input.toolCall.arguments,
+        rules: input.rules,
+        availableTools: input.availableTools
+    });
+    const context = {
+        messages: [
+            {
+                role: "user",
+                content: [{ type: "text", text: reviewPrompt }],
+                timestamp: Date.now()
+            }
+        ]
+    };
+    try {
+        const result = await input.inferenceRouter.complete(context, `app-review:${input.appId}`, {
+            providersOverride: input.providersOverride
+        });
+        const text = messageExtractText(result.message)?.trim() ?? "";
+        return appReviewDecisionParse(text);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return { allowed: false, reason: `Review failed: ${message}` };
+    }
+}
+function appReviewDecisionParse(text) {
+    if (/^ALLOW\b/i.test(text)) {
+        return { allowed: true };
+    }
+    const denyMatch = text.match(/^DENY\s*:\s*(.+)$/is);
+    if (denyMatch) {
+        const reason = denyMatch[1]?.trim();
+        return { allowed: false, reason: reason && reason.length > 0 ? reason : "Denied by review model." };
+    }
+    if (/^DENY\b/i.test(text)) {
+        return { allowed: false, reason: "Denied by review model." };
+    }
+    return { allowed: false, reason: "Review model returned an invalid decision." };
+}
+//# sourceMappingURL=appToolReview.js.map

package/dist/engine/apps/appToolReview.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appToolReview.js","sourceRoot":"","sources":["../../../sources/engine/apps/appToolReview.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAoBjE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAyB;IAC3D,MAAM,YAAY,GAAG,MAAM,oBAAoB,CAAC;QAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;QAC7B,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;QAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,OAAO,GAAY;QACvB,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;gBAC/C,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB;SACF;KACF,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,EAAE,cAAc,KAAK,CAAC,KAAK,EAAE,EAAE;YACxF,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;SAC3C,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC9D,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,OAAO,EAAE,EAAE,CAAC;IACjE,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY;IAC1C,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACpD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACpC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,yBAAyB,EAAE,CAAC;IACtG,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC/D,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC;AAClF,CAAC"}

package/dist/engine/apps/appToolReview.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=appToolReview.spec.d.ts.map

package/dist/engine/apps/appToolReview.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appToolReview.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/apps/appToolReview.spec.ts"],"names":[],"mappings":""}

package/dist/engine/apps/appToolReview.spec.js

@@ -0,0 +1,144 @@
+import { describe, expect, it, vi } from "vitest";
+import { appToolReview } from "./appToolReview.js";
+describe("appToolReview", () => {
+    it("returns allowed=true for ALLOW response", async () => {
+        const review = await appToolReview({
+            appId: "github-reviewer",
+            appName: "GitHub Reviewer",
+            appSystemPrompt: "You are a focused review assistant.",
+            rlmEnabled: false,
+            sourceIntent: "Review pull requests safely.",
+            toolCall: { id: "t1", name: "read", type: "toolCall", arguments: { path: "/tmp/file" } },
+            rules: { allow: [], deny: [] },
+            availableTools: availableToolsBuild(),
+            inferenceRouter: inferenceRouterBuild(assistantMessageBuild("ALLOW"))
+        });
+        expect(review).toEqual({ allowed: true });
+    });
+    it("returns denied with reason for DENY response", async () => {
+        const review = await appToolReview({
+            appId: "github-reviewer",
+            appName: "GitHub Reviewer",
+            appSystemPrompt: "You are a focused review assistant.",
+            rlmEnabled: false,
+            sourceIntent: "Review pull requests safely.",
+            toolCall: { id: "t1", name: "exec", type: "toolCall", arguments: { command: "rm -rf ." } },
+            rules: { allow: [], deny: [] },
+            availableTools: availableToolsBuild(),
+            inferenceRouter: inferenceRouterBuild(assistantMessageBuild("DENY: destructive command"))
+        });
+        expect(review).toEqual({ allowed: false, reason: "destructive command" });
+    });
+    it("denies malformed responses", async () => {
+        const review = await appToolReview({
+            appId: "github-reviewer",
+            appName: "GitHub Reviewer",
+            appSystemPrompt: "You are a focused review assistant.",
+            rlmEnabled: false,
+            sourceIntent: "Review pull requests safely.",
+            toolCall: { id: "t1", name: "exec", type: "toolCall", arguments: { command: "echo ok" } },
+            rules: { allow: [], deny: [] },
+            availableTools: availableToolsBuild(),
+            inferenceRouter: inferenceRouterBuild(assistantMessageBuild("maybe"))
+        });
+        expect(review.allowed).toBe(false);
+        expect(review.reason).toContain("invalid decision");
+    });
+    it("includes available tool context in the review prompt", async () => {
+        const complete = vi.fn(async (_context) => ({
+            message: assistantMessageBuild("ALLOW"),
+            providerId: "provider-1",
+            modelId: "model-1"
+        }));
+        const inferenceRouter = { complete };
+        await appToolReview({
+            appId: "github-reviewer",
+            appName: "GitHub Reviewer",
+            appSystemPrompt: "You are a focused review assistant.",
+            rlmEnabled: true,
+            sourceIntent: "Review pull requests safely.",
+            toolCall: { id: "t1", name: "exec", type: "toolCall", arguments: { command: "echo ok" } },
+            rules: { allow: [], deny: [] },
+            availableTools: availableToolsBuild(),
+            inferenceRouter
+        });
+        const firstCall = complete.mock.calls[0];
+        expect(firstCall).toBeTruthy();
+        if (!firstCall) {
+            throw new Error("Expected review model call");
+        }
+        const context = firstCall[0];
+        const prompt = context.messages?.[0]?.content?.find((item) => item.type === "text")?.text ?? "";
+        expect(prompt).toContain("## Available Tools In This Sandbox");
+        expect(prompt).toContain("Name: exec");
+        expect(prompt).toContain('not Python exec()');
+        expect(prompt).toContain("## App System Prompt");
+        expect(prompt).toContain("You are a focused review assistant.");
+        expect(prompt).toContain("RLM mode is enabled.");
+        expect(prompt).toContain("`run_python` tool");
+        expect(prompt).toContain("minimal Python runtime (Monty)");
+        expect(prompt).toContain("not full CPython");
+        expect(prompt).toContain("`read(...)`, `exec(...)`");
+    });
+});
+function inferenceRouterBuild(message) {
+    return {
+        complete: vi.fn(async () => ({
+            message,
+            providerId: "provider-1",
+            modelId: "model-1"
+        }))
+    };
+}
+function assistantMessageBuild(text) {
+    return {
+        role: "assistant",
+        content: [{ type: "text", text }],
+        api: "openai-responses",
+        provider: "test-provider",
+        model: "test-model",
+        usage: {
+            input: 0,
+            output: 0,
+            cacheRead: 0,
+            cacheWrite: 0,
+            totalTokens: 0,
+            cost: {
+                input: 0,
+                output: 0,
+                cacheRead: 0,
+                cacheWrite: 0,
+                total: 0
+            }
+        },
+        stopReason: "stop",
+        timestamp: Date.now()
+    };
+}
+function availableToolsBuild() {
+    return [
+        {
+            name: "exec",
+            description: "Run a shell command in the workspace.",
+            parameters: {
+                type: "object",
+                properties: {
+                    command: { type: "string" }
+                },
+                required: ["command"]
+            }
+        },
+        {
+            name: "read",
+            description: "Read file contents.",
+            parameters: {
+                type: "object",
+                properties: {
+                    path: { type: "string" }
+                },
+                required: ["path"]
+            }
+        }
+    ];
+}
+//# sourceMappingURL=appToolReview.spec.js.map

package/dist/engine/apps/appToolReview.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appToolReview.spec.js","sourceRoot":"","sources":["../../../sources/engine/apps/appToolReview.spec.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAGlD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;YACjC,KAAK,EAAE,iBAAiB;YACxB,OAAO,EAAE,iBAAiB;YAC1B,eAAe,EAAE,qCAAqC;YACtD,UAAU,EAAE,KAAK;YACjB,YAAY,EAAE,8BAA8B;YAC5C,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;YACxF,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;YAC9B,cAAc,EAAE,mBAAmB,EAAE;YACrC,eAAe,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;SACtE,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;YACjC,KAAK,EAAE,iBAAiB;YACxB,OAAO,EAAE,iBAAiB;YAC1B,eAAe,EAAE,qCAAqC;YACtD,UAAU,EAAE,KAAK;YACjB,YAAY,EAAE,8BAA8B;YAC5C,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE;YAC1F,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;YAC9B,cAAc,EAAE,mBAAmB,EAAE;YACrC,eAAe,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,2BAA2B,CAAC,CAAC;SAC1F,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;YACjC,KAAK,EAAE,iBAAiB;YACxB,OAAO,EAAE,iBAAiB;YAC1B,eAAe,EAAE,qCAAqC;YACtD,UAAU,EAAE,KAAK;YACjB,YAAY,EAAE,8BAA8B;YAC5C,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE;YACzF,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;YAC9B,cAAc,EAAE,mBAAmB,EAAE;YACrC,eAAe,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;SACtE,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,QAAiB,EAAE,EAAE,CAAC,CAAC;YACnD,OAAO,EAAE,qBAAqB,CAAC,OAAO,CAAC;YACvC,UAAU,EAAE,YAAY;YACxB,OAAO,EAAE,SAAS;SACnB,CAAC,CAAC,CAAC;QACJ,MAAM,eAAe,GAAG,EAAE,QAAQ,EAAgC,CAAC;QACnE,MAAM,aAAa,CAAC;YAClB,KAAK,EAAE,iBAAiB;YACxB,OAAO,EAAE,iBAAiB;YAC1B,eAAe,EAAE,qCAAqC;YACtD,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,8BAA8B;YAC5C,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE;YACzF,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;YAC9B,cAAc,EAAE,mBAAmB,EAAE;YACrC,eAAe;SAChB,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,SAAS,CAAC,CAAC,UAAU,EAAE,CAAC;QAC/B,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAE1B,CAAC;QACF,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;QAChG,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;QAC/D,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAC9C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,qCAAqC,CAAC,CAAC;QAChE,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAC9C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,gCAAgC,CAAC,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,SAAS,oBAAoB,CAAC,OAAyB;IACrD,OAAO;QACL,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YAC3B,OAAO;YACP,UAAU,EAAE,YAAY;YACxB,OAAO,EAAE,SAAS;SACnB,CAAC,CAAC;KAC0B,CAAC;AAClC,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY;IACzC,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACjC,GAAG,EAAE,kBAAkB;QACvB,QAAQ,EAAE,eAAe;QACzB,KAAK,EAAE,YAAY;QACnB,KAAK,EAAE;YACL,KAAK,EAAE,CAAC;YACR,MAAM,EAAE,CAAC;YACT,SAAS,EAAE,CAAC;YACZ,UAAU,EAAE,CAAC;YACb,WAAW,EAAE,CAAC;YACd,IAAI,EAAE;gBACJ,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,CAAC;gBACT,SAAS,EAAE,CAAC;gBACZ,UAAU,EAAE,CAAC;gBACb,KAAK,EAAE,CAAC;aACT;SACF;QACD,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO;QACL;YACE,IAAI,EAAE,MAAM;YACZ,WAAW,EAAE,uCAAuC;YACpD,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iBAC5B;gBACD,QAAQ,EAAE,CAAC,SAAS,CAAC;aACtB;SACF;QACD;YACE,IAAI,EAAE,MAAM;YACZ,WAAW,EAAE,qBAAqB;YAClC,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iBACzB;gBACD,QAAQ,EAAE,CAAC,MAAM,CAAC;aACnB;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/engine/apps/appTypes.d.ts

@@ -0,0 +1,30 @@
+export type AppRule = {
+    text: string;
+    addedBy?: string;
+};
+export type AppRuleSet = {
+    allow: AppRule[];
+    deny: AppRule[];
+};
+export type AppManifest = {
+    name: string;
+    title: string;
+    description: string;
+    model?: string;
+    systemPrompt: string;
+};
+export type AppPermissions = {
+    sourceIntent: string;
+    rules: AppRuleSet;
+};
+export type AppDescriptor = {
+    id: string;
+    path: string;
+    manifest: AppManifest;
+    permissions: AppPermissions;
+};
+export type AppReviewDecision = {
+    allowed: boolean;
+    reason?: string;
+};
+//# sourceMappingURL=appTypes.d.ts.map

package/dist/engine/apps/appTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appTypes.d.ts","sourceRoot":"","sources":["../../../sources/engine/apps/appTypes.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,OAAO,GAAG;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,IAAI,EAAE,OAAO,EAAE,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,UAAU,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,WAAW,CAAC;IACtB,WAAW,EAAE,cAAc,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC"}

package/dist/engine/apps/appTypes.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=appTypes.js.map

package/dist/engine/apps/appTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appTypes.js","sourceRoot":"","sources":["../../../sources/engine/apps/appTypes.ts"],"names":[],"mappings":""}

package/dist/engine/engine.d.ts

@@ -16,6 +16,7 @@ import { DelayedSignals } from "./signals/delayedSignals.js";
 import { Processes } from "./processes/processes.js";
 import { PermissionRequestRegistry } from "./modules/tools/permissionRequestRegistry.js";
 import { Channels } from "./channels/channels.js";
+import { Apps } from "./apps/appManager.js";
 export type EngineOptions = {
     config: Config;
     eventBus: EngineEventBus;
@@ -38,6 +39,7 @@ export declare class Engine {
     readonly inferenceRouter: InferenceRouter;
     readonly eventBus: EngineEventBus;
     readonly permissionRequestRegistry: PermissionRequestRegistry;
+    readonly apps: Apps;
     private readonly reloadSync;
     private readonly incomingMessages;
     constructor(options: EngineOptions);

package/dist/engine/engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../sources/engine/engine.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,KAAK,EAAoC,MAAM,EAAkB,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAIrD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAiC7C,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAGvD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAQ1D,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAErD,OAAO,EAAE,yBAAyB,EAAE,MAAM,8CAA8C,CAAC;AACzF,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAKlD,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,cAAc,CAAC;CAC1B,CAAC;AAEF,qBAAa,MAAM;IACjB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,yBAAyB,EAAE,yBAAyB,CAAC;IAC9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiB;IAC5C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmB;gBAExC,OAAO,EAAE,aAAa;IAiO5B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA6EtB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAW/B,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAoCT,OAAO,CAAC,gBAAgB;YAeV,oBAAoB;YA8BpB,oBAAoB;YAOpB,kBAAkB;YAclB,iBAAiB;IA0BzB,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAI7B,OAAO,CAAC,YAAY;YAIN,UAAU;YAIV,oBAAoB;YAWpB,iBAAiB;CA4BhC"}
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../sources/engine/engine.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,KAAK,EAAoC,MAAM,EAAkB,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAIrD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAkC7C,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAGvD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAQ1D,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAErD,OAAO,EAAE,yBAAyB,EAAE,MAAM,8CAA8C,CAAC;AACzF,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAO5C,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,cAAc,CAAC;CAC1B,CAAC;AAEF,qBAAa,MAAM;IACjB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,yBAAyB,EAAE,yBAAyB,CAAC;IAC9D,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiB;IAC5C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmB;gBAExC,OAAO,EAAE,aAAa;IAkO5B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAkFtB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAW/B,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAoCT,OAAO,CAAC,gBAAgB;YAeV,oBAAoB;YA8BpB,oBAAoB;YAOpB,kBAAkB;YAclB,iBAAiB;IA0BzB,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAI7B,OAAO,CAAC,YAAY;YAIN,UAAU;YAIV,oBAAoB;YAWpB,iBAAiB;CA4BhC"}